For high-volume needs or compliance, XSOAR can be configured to export incidents (including their data) to external storage automatically:
The most direct way to download context data is using the automation script. xsoar download context data
: Once the file appears in the War Room, you can click the download icon to save it locally. 2. Manual Export via Incident Management For high-volume needs or compliance, XSOAR can be
: This script takes the current incident's context and exports it into a JSON file, which is then uploaded to the incident's War Room. Manual Export via Incident Management : This script
Cortex XSOAR (Security Orchestration, Automation, and Response) uses as a temporary, structured storage map (dictionary) for each incident. While this data is typically used to pass information between playbook tasks, there are several methods to "download" or export it for external analysis, backup, or reporting. Methods to Download Context Data 1. Export via Automation Script
: On the Incidents page, you can select specific incidents and click Export to generate a Summary (CSV) or Detailed (Excel) report.